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In the Claim s: 

Please amend claims 1 and 3-8. Please add new claims 13-21 . The claims are as follows: 

1 . (Currently amended) A method enabling a network-addressable device to detect use of its 
identity by a spoofer, comprising the acts of: 

receiving a message by the network-addressable device; 

detecting a communication protocol violation consequent to the message, wherein the 
communication protocol violation is indicative «f activity of a n > ni»l of service a m <* on a ta rget 
byjt spoofmg vandal using an identity of the network-addressable device; and 

generating a spoofing alert responsive to the act of detecting the communication protocol 

violation. 

2. (Original) A method enabling a network-addressable device to detect use of its identity by a 
spoofer, comprising the acts of: 

receiving a message by the network-addressable device; 

detecting a communication protocol violation consequent to the message, wherein the 
communication protocol violation is indicative of activity of a spoofing vandal using the identity 
of the network-addressable device in an attack on a target; 

recording attributes o f the message; 

advancing the value of a counter associated with the target; 

comparing the value of the counter with a predetermined threshold; and 

generating a spoofing alert when the value of the counter exceeds the threshold. 
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3. (Currently amended) The method of claim 2, ftilbu uiumiMim the uU uf ,uuling flic 
spctrftaffrfert^^ whcrdn thc network-addressable device is connected to 
the target by a communication network. 

4. (Currently amended) The method of claim 3, wh u un the furthe r comprise sending 
^pnnfln imlattoft network administrator wjao. is Htt u ualul ui t h re sponsible for the network- 
addressable device. 

5. (Currently amended) Thc method of claim 3, wherem-tfae frrthrr comprising sending the 
mgoflDS alert to a network administrator wJia is a^uualul with res ponsible for the target. 

6. (Currently amended) The method of claim [[2]] 3, further comprising *»*rf blocking the 
message advancing fu rthrr into t he network-addressable device . 

7. (Currently amended) The method of claim {[2]] 3, wherein the-acKrf ^ccor^mm^ 
recording said attributes of thc message iuUudu l ln-aUuf ^iLiiig a nund to in a spoofing 

logbook database. 

8. (Currently amended) The method olclaim ([2]] 7, wherein thvaUuf iu,uulin±, ulUibutci tif 
ttosng c4ncin^ S ^ ^ uf w. King th, m e ^ u, a s p u ufi^ l ogbook*** s^dj^ordei 
■.MHuUg of the mC3_M^hcsr^gJQgV'nn)r ,H*^ ™mpmr. n pmy. address of the , 
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messa ge Hps hccn receive d. 

9. (Original) The method of claim 2, wherein the identity of the network-addressable device is a 
TCP/IP source address of the network-addressable device. 

10. (Original) The method of claim 2, wherein the protocol violation includes reception by the 
network-addressable device of an unsolicited response message sent by the target. 

11. (Original) The method of claim 2, wherein the protocol violation includes the reception by 
the network-addressable device of an ICMP reply sent by the target when an 1CMP PING has not 
been sent to the target by the network-addressable device. 

12. (Original) The method of claim 2, wherein the protocol violation includes reception by the 
network-addressable device of a SYN/ACK message when a SYN message has not been sent to 
the target by the network-addressable device. 

13. (New) The method of claim 3, wherein the communication network comprises the Internet. 

14. (New) The method of claim 3, wherein the attack on the target by the spoofing vandal 
comprises a denial of service attack on the target by the spoofing vandal. 

15. (New) The method of claim 3, further comprising providing a first network administrator 
09/849,697 4 
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who is responsible for the network-addressable device and a second network administrator who 

is responsible for the target. 

16. (New) The method of claim 15, further comprising sending the spoofing alert to both the first 
network administrator and the second network administrator. 

17. (New) The method of claim 15, wherein the first network administrator is a first automated 
network management system, and wherein the second network adirunistrator is a second 
automated network management system. 

18. (New) The method of claim 3, wherein the network-addressable device is connected to the 
spoofing vandal by the communication network. 

19. (New) The method of claim 3, wherein said detecting, recording, advancing, comparing, and 
generating arc performed by the network-addressable device. 

20. (New) The method of claim 2, wherein the network-addressable device is connected to the 
spoofing vandal by a communication network. 

21 . (New) The method of claim 2, wherein said detecting, recording, advancing, comparing, and 
generating are performed by the network-addressable device. 
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